Pragyan CMS 3.0 SQL Injection

`Advisory: SQL injection vulnerability in Pragyan CMS v.3.0  
Advisory ID: SROEADV-2015-11  
Author: Steffen Rösemann  
Affected Software: Pragyan CMS v.3  
Vendor URL: https://github.com/delta/pragyan, http://delta.nitt.edu/  
Vendor Status: vendor did not respond after initial communication  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
Pragyan CMS v. 3 suffers from a SQL injection vulnerability that can be  
abused even by unauthenticated attackers.  
  
==================  
Technical Details:  
==================  
  
The user-profile of registered users of Pragyan CMS v.3 is vulnerable to  
SQL injection attacks. A user-profile can be found in the following  
location of a common Pragyan CMS installation:  
  
http://{TARGET}/user:1  
  
Exploit-Example:  
  
http://  
{TARGET}/user:1%27+and+1=2+union+select+database%28%29,version%28%29,3+--+  
  
  
  
=========  
Solution:  
=========  
  
Vendor notified, did not respond after initial communication.  
  
If you use Pragyan CMS v.3, please locate the file userprofile.lib.php and  
use my patch (see [5], usage at your own risk!).  
  
  
  
  
====================  
Disclosure Timeline:  
====================  
18-Jan-2015 – found the vulnerability  
19-Jan-2015 - informed the developers (see [3])  
19-Jan-2015 – release date of this security advisory [without technical  
details]  
19-Jan-2015 - forked the project to keep it available/researchable in its  
current state for other researchers [4]  
03-Feb-2015 - release date of this security advisory  
03-Feb-2015 - provided a patch for vulnerability (see [5])  
03-Feb-2015 - send to FullDisclosure  
  
  
  
========  
Credits:  
========  
  
Vulnerability found and advisory written by Steffen Rösemann.  
  
===========  
References:  
===========  
  
[1] http://delta.nitt.edu/ / https://github.com/delta/pragyan  
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html  
[3] https://github.com/delta/pragyan/issues/206  
[4] https://github.com/sroesemann/pragyan  
[5] http://pastebin.com/ip2gGYuS  
  
  
`